PIC Standard
Provenance & Intent Contracts
Require verifiable evidence before your AI agent acts.
PIC adds a check right before an AI agent uses a tool. It looks at what the agent wants to do, where its information came from, and whether real evidence supports it. No evidence, no action.
Most agent controls focus on what an agent is allowed to do. PIC also checks whether the action it is about to take has evidence behind it.
Permission is not proof
AI agents can send emails, move money, export data and run commands. But having permission to use a tool doesn't make a specific action right. Agents get fooled by fake instructions, trust the wrong source, or claim approvals nobody gave.
PIC makes the agent show its evidence before it acts: what it wants to do, where that came from, and proof that backs it up, like a signed approval from a key you trust.
PIC checks actions before they happen, not after the damage is done. Its MCP guard verifies the evidence and the exact tool arguments, then executes only the checked call. If verification fails, the tool never runs. The decision is enforced in code, not left to the AI agent.
Open source. Runs locally. Your rules, your keys.
A Slack message tells an agent: "Pay the $500 invoice from Vendor X." The agent has access to the payment tool. Without PIC, that is often enough.
With PIC, the agent must show where the instruction came from and what proves the invoice is real. A Slack message is untrusted input, and no signed approval backs the claim. PIC returns block. The payment tool never runs.
If finance approves the invoice with a key you trust, the same payment goes through. Same agent, same tool. The difference is evidence.
Quick Start
See PIC approve a signed payment and block a tampered one. About two minutes on your machine.
git clone https://github.com/pic-standard/pic-standard.git
cd pic-standard
python -m pip install -e ".[crypto]"
export PIC_KEYS_PATH="$PWD/pic_keys.example.json"
# Windows PowerShell: $env:PIC_KEYS_PATH = "$PWD\pic_keys.example.json"pic-cli verify examples/financial_sig_ok.json --verify-evidence
# PASS: Schema valid
# PASS: Verifier passedpic-cli verify examples/failing/financial_sig_bad.json --verify-evidence
# PASS: Schema valid
# FAIL: Evidence verification failedAdd --json for machine-readable output, including the error code PIC_EVIDENCE_FAILED.
pip install "pic-standard[mcp,crypto]" # MCP tool guard with argument binding
pip install "pic-standard[langgraph,crypto]" # LangGraph PICToolNodeWhy PIC Exists
Guardrails constrain what the model says. PIC controls what the agent actually does, based on evidence you can verify.
When an AI takes a meaningful action, most stacks still struggle to answer basic questions:
For low-risk tasks, that may be fine. For high-impact actions, it is not.
PIC answers all four before the tool runs, stopping prompt injections and blind tool calls at the action boundary.
The PIC Contract
Before a tool runs, the agent hands PIC a structured Action Proposal. Every part is checked.
Intent
What the agent is trying to do, in plain words
Impact
How much is at stake: read, write, external, compute, money, privacy or irreversible
Provenance
Which inputs shaped the decision, and whether each one is trusted
Claims
What the agent says is true, and the evidence backing it up
Evidence
Evidence that can be checked, including SHA-256 hashes and Ed25519 signatures
Action
The exact tool and arguments the agent wants to run
The rule: money, privacy and irreversible actions need evidence from a trusted source. No trusted evidence, no action.
How PIC Fits Into an Agent Stack
Proposal
The agent describes the action it wants to take, with its sources and evidence.
Verification
PIC checks the proposal against your policy and the keys you trust.
Decision
PIC allows the action when the checks pass. Otherwise, it blocks the call before execution.
Audit
PIC records its decisions, so you can see what was allowed, what was blocked, and why.
Works with your existing stack:
Guards MCP tools, binds the exact arguments, optional pre-execution hook
PICToolNode checks every proposal before a tool runs
Plugin that checks each tool call and blocks on failure
Pack that routes workflows on PIC's verdict
Verification API for any language; your app enforces the verdict
What This Enables
Give agents real tools
Let agents handle payments, data and commands, knowing high-impact actions need evidence first.
Know why, every time
See what was proposed, what evidence backed it, and why it was allowed or blocked.
Security outside the model
Checks run in your code, not in the model, so a fooled agent can't talk its way past them.
Looking for Contributors
PIC is heading to v1.0, and this is the moment to shape it. Start small or go deep.
Interested in the problem space but not ready to code? Thoughtful review, issue feedback, and architecture discussion are valuable too.
Built for Technical Teams
More than a specification. Two implementations, shared conformance tests, and cryptographically signed releases.
What's under the hood:
Relevant for teams working on:
Give Your Agents Evidence, Not Just Permission
Run the Quick Start, plug PIC into your agent, or help shape v1.0.
Give your agents the tools to get real work done, without having to trust every decision they make.
A star helps other builders find PIC, and brings more security experts and framework authors into the project.